Chrome version 63 and later
Applies to managed Chrome browsers and ChromeOS devices.
As a Chrome administrator, you can protect Chrome browser users who visit untrusted sites by using site isolation.
Site isolation separates pages from different websites into different processes. When site isolation is turned on, it's harder for malicious sites to bypass security measures that exist to prevent data theft. It can block the processes from receiving certain types of sensitive data from other sites and a malicious website will find it much more difficult to steal data from other sites, even if it can break some rules in its own process.
Site isolation applies to sites such as https://example.com and usually groups together other origins within that site such as https://a.example.com.
Site isolation is enabled by default on Desktop platforms as of Chrome 76, and for most sites that users log into on Android as of Chrome 77. Learn more about Site isolation.
You can block users from disabling site isolation, and you can isolate more specific origins within sites of your choice. On Android, you can also enable site isolation for all sites.
Step 1: Review policies
| Policy | Description and settings |
|---|---|
| SitePerProcess |
Windows, Mac, and Linux When enabled—Site isolation is enabled for all websites for your entire organization. All sites that users visit will run in a dedicated rendering process, isolated from each other. Users cannot opt out of site isolation using, for example, chrome://flags. When disabled or unset—Site isolation remains enabled but users can opt out using, for example, chrome://flags. |
| IsolateOrigins |
Windows, Mac, and Linux When enabled—Isolates additional specific origins that users visit. Origins you specify run in a dedicated rendering process. You can include origins that users sign in to and other origins that contain sensitive information, such as productivity sites or intranet sites. When disabled or unset—Site isolation remains enabled but no additional origins will be isolated. Users can list additional origins to isolate using, for example, chrome://flags. |
| SitePerProcessAndroid |
Android When enabled—Applies to Android devices with at least 1 GB RAM. Turns on site isolation for all websites for your entire organization. All sites that users visit will run in a dedicated rendering process, isolated from each other. Users cannot opt out of site isolation using, for example, chrome://flags. When unset—Applies to M77 or later and Android devices with at least 2 GB RAM. Site isolation is enabled only for sites that users sign into. When disabled—Site isolation is turned off entirely. This policy overrides the settings for both sites that users sign into and the IsolateOriginsAndroid policy. |
| IsolateOriginsAndroid |
Android When enabled—Applies to Android devices with at least 1 GB RAM. Isolates additional specific origins that users visit. Origins you specify run in a dedicated rendering process. You can include origins that users sign in to and other origins that contain sensitive information, such as productivity sites or intranet sites. When unset—Applies to M77 or later and Android devices with at least 2 GB RAM. Site isolation is enabled only for sites that users sign into. When disabled—Site isolation is turned off entirely. This policy overrides the SitePerProcessAndroid policy. |
Step 2: Create a list of sites to isolate
On Chrome 76 and earlier, you create a list of all of the origins that you want to isolate by specifying each origin in full. For example:
https://a.example.com, https://b.example.com, ;https://c.example.com.
From Chrome 77 and later, you can also specify a range of origins to isolate using a wildcard.
For example, specifying https://[*.]example.com isolates https://a.example.com, https://b.example.com, and https://c.example.com. In addition, it isolates any matching origin under https://[*.]example.com, such as:
https://a1.example.comhttps://a2.a1.example.comhttps://a3.a2.a1.example.com
You can use the wildcard notation to isolate a whole range of origins in a convenient way. For example, specifying https://[*.]corp.solarmora.com ensures that all Solarmora corporate origins are isolated.
Step 3: Turn on site isolation
Click below for steps, based on how you want to manage these policies.
Admin consoleCan apply for signed-in users on any device or enrolled browsers on Windows, Mac, Linux or Android. For details, see Understand when settings apply.
Important: Make sure Managed Chrome browser is turned on for the organization.
-
In the Admin console, go to Menu
Devices
Chrome
If you signed up for Chrome Enterprise Core, go to Menu
Chrome browser
-
To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
- Go to the Site isolation section.
- For Windows, Mac, and Linux, click Site isolation:
- To require site isolation for all websites:
- Select Require site isolation for all websites, as well as any origins below.
- (Optional) Enter additional origins, separated by commas, that you want to isolate from their respective websites. For example, enter https://login.example.com to keep it isolated from the rest of https://example.com.
-
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit.
- To enable isolation for all websites but also allow users to opt out of site isolation for specific websites (default):
- Select Enable site isolation for all websites and any origins below, but allow users to opt out.
- (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
-
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit.
- To turn on site isolation for login websites only (default):
- Select Turn on site isolation only for login sites, as well as any origins below.
- (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
- Click Save.
- To allow users to choose if they want to enable site isolation:
- Select Allow user to choose to enable site isolation.
- (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
-
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit.
- To turn on site isolation for all websites:
- Select Turn on site isolation for all websites, as well as any origins below.
- (Optional) Enter a list of websites and origins, separated by commas, that you want to isolate.
-
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit.
- To require site isolation for all websites:
Using Group Policy
In Group Policy Editor, go to Computer or User Configuration 
Require site isolation for all websites
Note: Site Isolation is always enabled on Windows, and the SitePerProcess policy is only used to prevent the user from opting out.
Leaving this policy Not Configured uses the Unset behavior described above.
-
Locate and enable Enable Site Isolation for every website.
Tip: If you don’t see this policy, download the latest policy template. - Deploy the update to your users.
Turn on site isolation for specific origins
Leaving this policy Not Configured uses the Unset behavior described above.
- Test site isolation for these sites locally using the command line flag:
- - isolate-origins=https://[*.]example.com, https://subdomain.example.org - Locate and enable Enable Site Isolation for specified origins.
Tip: If you don’t see this policy, download the latest policy template.
-
Enter URLs for isolation in a comma-separated list.
Example:https://[*.]example.com/,https://subdomain.example.org - Deploy the update to your users.
In your Chrome configuration profile, add or update the following keys. Then, deploy the change to your users.
<dict>
<key>SitePerProcess</key>
<true/>
</dict>
<dict>
<key>IsolateOrigins</key>
<string>”https://www.site1.com,https://www.site2.net”</string>
</dict>
Using your preferred JSON file editor:
- Go to your etc/opt/chrome/policies/managed folder.
- Create or update a JSON file and enter URLs as needed:
- SitePerProcess—Set to true to require the policy.
- IsolateOrigins—Add the URLs that you want to isolate.
- Test site isolation for these sites locally using the command line flag:
- - isolate-origins=https://[*.]example.com, https://subdomain.example.org - Deploy the update to your users.
This example shows how to require the SitePerProcess policy:
{
”SitePerProcess": "true”
}
This example shows how to isolate a.example.com and b.example.net:
{
“IsolateOrigins”:”https://a.example.com/,https://b.example.net/”
}
Step 4: Verify policies have been applied
After you apply any Chrome policies, users need to restart Chrome browser for the setting to take effect. You can check users’ devices to make sure the policy was applied correctly.
- On a managed ChromeOS device, browse to chrome://policy.
- Click Reload policies.
- Check the Show policies with no value set box.
- For the policies you set, make sure Status is set to OK.
- For each policy, click Show value and make sure that the value fields are the same as what you set in the policy.
Turn off site isolation (Android only)
To turn off site isolation, disable the Android policies you set above.
After you disable the isolation policy, Chrome uses its pre-site isolation process model to render websites. Different sites might share processes with each other. And cross-site frames might be rendered in the same process as their parent page. Disabling a policy disables field trials of both policies.
Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.